Issues with Sonic 1G Fiber, IPv6, and Meraki

[finalstar]

Hello, I have a Meraki MX as my router and that is connected to the Sonic ONT. I have been having issues with getting an IPv6 address from Sonic since Meraki added the added the ability to use IPv6. I often seem to have issues getting an IPv6 address and when I do get an address, the access to IPv6 IPs seems to be inconsistant.

I did a packet capture from my Meraki during the DHCPv6 and noticed that the Advertise reply I get has "Status Code: NoPrefixAvail (6)" and "Status Message: No prefixes have been assigned".


I also have a question about getting IPs to my devices. If I am understandig the documention, Sonic issues me a /56 and I am resposible for setting up DHCP on my LAN, correct?

[jerrielm]

Hello!

Sadly, looking at certain routers is not something we are really set up but i did find an article on IPv6 for the router that you said. I can also see that IPv6 is live in your area so it should be working. I can see on your account that IPv6 is working as well. I believe that your prefex is /56 if that does not work then /64 might.

Setting up IPv6 on a third party router is a little more work. Navigate to https://members.sonic.net/labs/ipv6tunnel/ and create a tunnel. You'll then want to fill in the endpoint as the user's public facing IPv4 address and click the button on that page to update the tunnel. The user will then plug all the information (the transport, the network and the end point) into their IPv6 compatible router. We do not support IPv6 setup on third party routers, so the user should direct any questions they have outside of the information provided here to the device manufacturer or online forums.

https://documentation.meraki.com/?title ... ntals%255D

Additional information:
https://forum.openwrt.org/t/solved-dhcp ... tion/48306

https://www.youtube.com/watch?v=YYZC--b ... RKINGWITHH


Let me know if any of this helped!

[dane]

I don't think IPv6 tunnel setup would be applicable, now that IPv6 is rolled out all across the fiber network.

But yes, we can't support non-Sonic equipment, that'd be a DIY project.

[jacklondoninternet]

Having the same issue ever since Meraki started supporting IPv6 and Sonic has it turned on. Have a 1g fiber connection.

I endup with two wan addresses, one ipv6 and one ipv4. I get connectivity, but sometimes it just stops.. I don't understand why. When issues occur, the Meraki firewall is still up on the dashboard, but anything underneath it has no connectivity. The firewall shows dns issues.. So I tried using the meraki dns tools on the mx to reach something with the ipv6 dns and that works. When I unplug the router from the ONT and plug it back in, all of sudden everything is working again.

I think the issue has to do with the Meraki router/firewall switching over to using the ipv6 and still somehow uses the ipv4 dns for whatever reason.

Is it possible to disable ipv6 for an account from the sonic side? Its currently not possible to do it on the router/firewall itself.

[brandonc]

Is it possible to disable ipv6 for an account from the sonic side? Its currently not possible to do it on the router/firewall itself.

Unfortunately, that's not something we're able to do on an individual level at this time. We would have to turn it off for the entire card servicing the neighborhood, which we can't justify doing for a third-party equipment issue. We would only perform such action for maintenance for issues on our network.

I might suggest reaching out to the router manufacturer directly to inform them of the problem and they might be able to push through a new firmware update to repair the issue from their side if it's a wide-spread issue with their equipment and IPv6.

Kind regards,

[tigertech]

I don't think IPv6 tunnel setup would be applicable, now that IPv6 is rolled out all across the fiber network.

Dane, are you saying that IPv6 should be available to all fiber customers? I'm in Berkeley via "lo0.bng2.albyca11.sonic.net", and still don't see working IPv6 advertisements:

Code: Select all

$ tshark -i eth0 -x -f '(udp port 546 or 547) or icmp6'

0.000000 fe80::1ae8:29ff:fe2a:ce2d -> ff02::1:2    DHCPv6 114 Solicit XID: 0x955645 CID: 000100012ceb156018e8292ace2d

0.131446 fe80::669:8fff:fe3b:6f70 -> fe80::1ae8:29ff:fe2a:ce2d DHCPv6 241 Advertise XID: 0x955645 CID: 000100012ceb156018e8292ace2d IAA: ::
[...]
00a0  00 2b 00 02 4e 6f 20 61 64 64 72 65 73 73 65 73   .+..No addresses
00b0  20 68 61 76 65 20 62 65 65 6e 20 61 73 73 69 67    have been assig
00c0  6e 65 64 20 66 6f 72 20 49 41 5f 4e 41 00 17 00   ned for IA_NA...

The "fe80::669:8fff:fe3b:6f70" is from a Juniper MAC address that matches my upstream IPv4 router (23.93.184.1).

If it's supposed to be working, that would be very helpful to know so I can troubleshoot my setup. Thank you.

[finalstar]

I don't think IPv6 tunnel setup would be applicable, now that IPv6 is rolled out all across the fiber network.

But yes, we can't support non-Sonic equipment, that'd be a DIY project.

Hello Dane, I totally understand that there is no official support for DIY stuff and I am sorry if my question came across as "fix my Meraki", but from the traffic I am seeing it appears that the DHCP response from Sonic is saying that no Prefixes are assigned to my network.

I see the Router Advertisement setting a Juniper device as my next hop and the flag set to use DHCPv6 to get the remaining information. I see the first IA_NA conversation that sets my Meraki's IPv6 Address and DNS, but when my Meraki sends the IA_PD request to the network, the responce I get is "Status Code 13 / Status Code: NoPrefixAvail (6) / Status Message: No prefixes have been assigned".

I know I had an issue with my account a little while ago where too many MAC Addresses were sent to Sonic, and I do not know if this could be related where the Sonic network got too many requests from my network and accidently reserved my /56. Is there a way someone can check my IPv6 configuration and maybe clear whatever assignements might be in place?

[bubba198]

Same question as @tigertech - is IPv6 supposed to be rolled out naively? If yes where? Is it all across Sonic or certain areas? What areas?

[brandonc]

Hello Dane, I totally understand that there is no official support for DIY stuff and I am sorry if my question came across as "fix my Meraki", but from the traffic I am seeing it appears that the DHCP response from Sonic is saying that no Prefixes are assigned to my network.

I see the Router Advertisement setting a Juniper device as my next hop and the flag set to use DHCPv6 to get the remaining information. I see the first IA_NA conversation that sets my Meraki's IPv6 Address and DNS, but when my Meraki sends the IA_PD request to the network, the responce I get is "Status Code 13 / Status Code: NoPrefixAvail (6) / Status Message: No prefixes have been assigned".

I know I had an issue with my account a little while ago where too many MAC Addresses were sent to Sonic, and I do not know if this could be related where the Sonic network got too many requests from my network and accidently reserved my /56. Is there a way someone can check my IPv6 configuration and maybe clear whatever assignements might be in place?

Same question as @tigertech - is IPv6 supposed to be rolled out naively? If yes where? Is it all across Sonic or certain areas? What areas?

IPv6 is now native across all of our Fiber 1gbps and Fiber 10gbps service in all areas. For @tigertech, I see you have a /56 prefix assigned to your router currently, so you should be seeing that on your end. I would suggest double-checking your router's configuration.

Kind regards,

[tomoc]

I would like to provide some additional information from the Sonic side after further investigation.

On the BNG platform upstream of you, each separate Solicit request must have a unique DUID. In order to run IA_NA and IA_PD, your device must either use DUID Type 1 or have both requests in a single Solicit.

Since Type 1 includes the request timestamp, this should satisfy the uniqueness constraint required whereas Type 2 and Type 3 are static. The upstream vendor has acknowledged this behavior but there is no expected timeline on a change of this behavior.

One workaround is to disable IA_NA and only use IA_PD. This won't get your router a public address, but the IA_PD block will be routable over your WAN link-local address.

I hope this helps